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[57] ABSTRACT 

A system and method for collecting reference waveforms 
from authorized wireless telephones in a wireless telephone 
network. The collected reference waveforms are used by a 
fingerprint analyzer to distinguish telephone calls made by 
the authorized wireless telephone from telephone calls made 
by an unauthorized wireless telephone. The system main- 
tains a pool of specially designated unassigned telephone 
numbers and selects one telephone number from the pool at 
random which is provided to a valid subscriber of an 
authorized wireless telephone. The randomly selected tele- 
phone number is to be called by the valid subscriber using 
the authorized cellular telephone for the purpose of collect- 
ing reference waveforms by the system. A radio frequency 
(RF) receiver of the system monitors and receives transmis- 
sion signals from a plurality of wireless telephones. Each 
transmission signal contains a destination telephone number 
and an identification of its wireless telephone such as 
MIN/ESN identifiers. The system selects for purposes of 
collecting reference waveforms the transmission signal 
whose destination and wireless telephone identification 
respectively corre^ond to the randomly selected destination 
and the identification of the authorized wireless telephone. 
This ensures that that particular transmission signal belongs 
to the authorized wireless telephone of the valid subscriber 
rather than an unauthorized wireless telephone belonging to 
a pirate since the pirate has no way of knowing the randomly 
selected telephone number provided to the valid subscriber. 
The processor then extracts the reference waveform that 
represents a transmission characteristic of the authorized 
wireless telephone and stores the extracted reference wave- 
form in memory for use by the fingerprint analyzer. 

48 Claims, 6 Drawing Sheets 
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WAVEFORM COLLECTION FOR USE IN 
WIRELESS TELEPHONE IDENTIFICATION 

TECHNICAL FIELD 

The present inveatioD relates to wireless telephone 
systems, and in particular, to a system and method for 
collecting radio frequency waveforms of a wireless tele- 
phone for use in distinguishing an authorized wireless 
telephone from an unauthorized wireless telephone. 

BACKGROUND OF THE INVENTION 

Id a communications network, it is often desirable to 
identify and distinguish one transmitter from other trans- 
mitters operating within the network. For example, in the 
radio telephone industry, a cellular telephone system utilizes 
an electronic serial number (ESN) and a mobile telephone 
identification number (MIN) to provide a unique identifica- 
tion for each cellular telephone. To place a telephone call, 
the individual subscriber or other authorized user of a 
cellular telephone dials a telephone number and presses the 
"Send" button. In response, the cellular telephone transmits 
its ESN and MIN to the cellular system so the individual 
subscriber can be charged for the telephone call. 

Unfortunately, imscrupulous individuals illegally operate 
cellular telephones by "cloning" the ESN and MIN of a valid 
subscriber's telephone in order to obtain illegal access to the 
cellular system without paying for the service. A pirate can 
obtain the ESN and MIN of a cellular telephone by moni- 
toring a transmission of the cellular telephone, and then 
programming them into another telephone for illegal use. 
Thus, the mere transmission of the authentic ESN and MIN 
is inadequate to protect a cellular telephone system fi"om 
illegal use by pirates. 

In an effort to provide additional security, some cellular 
systems authenticate cellular telephones based on the trans- 
mission of data by the cellular telephone during a call set-up 
process. Rather than identify the cellular telephone by its 
ESN and MIN alone, the system identifies a cellular tele- 
phone by its transmission characteristics. In this manner, the 
cellular system can reject calls from cloned cellular tele- 
phones even when those cellular telephones transmit valid 
ESN and MIN numbers. For example, in U.S. Pat. No. 
5,005,210 issued to Ferrell on Apr. 2, 1991 ("the Ferrell 
patent"), incorporated herein by reference, a system is 
described that analyzes certain transmitter characteristics in 
an effort to identify the transmitter type. The system in the 
Ferrell patent analyzes the manner in which the modulator 
makes a transition to the designated carrier frequency. This 
transient reference waveform is used to identify the type of 
transmitter. The transmission characteristics of the reference 
waveform can be processed in different manners to create a 
"fingerprint" of the individual transmitter. 

WhUe the Ferrell patent describes one class of transmis- 
sion characteristics that can be used as a fingerprint, other 
fingerprint characteristics are also known in the art. For 
example. U.S. Pat. No. 5,420,910, issued to Rudokas on 
May 30, 1995 ("the Rudokas patent'*), incorporated herein 
by reference, describes an identifier, such as a radio fre- 
quency signature, that can be used to positively identify a 
valid cellular telephone or a known fraudulent telephone. 
Other types of signature or fingerprint authentication sys- 
tems are also known in the art. 

Fingerprint authentication systems all require at least one 
transmission characteristic waveform, known to be gener- 
ated by the authentic cellular telephone, to be used as a 
reference waveform for the fingerprint authentication sys- 
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tem. Some systems may rely on more than one reference 
waveforms to generate the fingerprint. The term fingerprint 
as used herein is intended to include reference waveforms 
transmitted by a transmitter as well as the various transmis- 
5 sion characteristics derived from those reference wave- 
forms. 

An effective fingerprint identification technique depends 
largely on the existence and quality of a database of stored 
fingerprints. In the Ferrell patent, a database of valid refer- 

10 ence waveforms are collected by waiting for the transmitters 
to turn on. Not surprisingly, this type of a passive collection 
process may take a very long time to develop due to the 
unpredictability of the turn-on behavior of the transmitters. 
Moreover, such a passive collection process is impractical in 

15 a commumications network such as a cellular telephone 
system in which there are millions of cellular telephones 
whose reference waveforms need to be collected. 

Moreover, even when a database of high quality finger- 
prints exists, there are times when the stored fingerprint of 
a particular authorized cellular telephone may not reflect the 
true transmission characteristics of that cellular telephone. 
One reason is that the transmission characteristics of the 
authorized cellular telephone may have changed over time 
due to the aging or peculiar nature of the transmitter circuits 
in the authorized cellular telephone. Another reason is that 
a sophisticated pirate may have discovered how the finger- 
print authentication system collects the reference waveforms 
and corrupted the stored fingerprint with a fingerprint of the 
unauthorized cellular telephone. As can be appreciated, this 
causes a serious problem for both the valid subscriber using 
the authorized telephone and the cellular service provider. 

If the fingerprint authentication system misidentifies a 
valid call from the authorized telephone as fraudiilent and 

25 blocks the call, the result is serious inconvenience to the 
valid subscriber and loss of revenue for the cellular service 
provider. On the other hand, if the fingerprint authentication 
system identifies a call from the pirate's unauthorized cel- 
lular telephone as authorized and allows the calls, it results 

^ in loss of revenue for the cellular service provider. Both 
situations are to be avoided if possible. 

Therefore, it can be appreciated that there is a significant 
need for a system and method for rapidly collecting refer- 
ence waveforms from an authorized cellular telephone to 

45 establish or reestablish a valid fingerprint. There is also a 
significant need to ensure that the reference waveforms 
being collected are transmitted from the authorized cellular 
telephone rather than from a pirate's unauthorized cellular 
telephone. The present invention provides these and other 

50 advantages as will be illustrated by the following desaiption 
and accompanying figures. 

SUMMARY OF THE INVENTION 

The present invention is embodied in a system and 
55 method for collecting a reference waveform from an autho- 
rized wireless telephone in a wireless telephone network. 
The collected reference waveforms are used by a fingerprint 
analyzer to distinguish telephone calls made by the autho- 
rized wireless telephone from telephone calls made by an 
60 unauthorized wireless telephone. 

In one aspect, the system includes a processor that main- 
tains a pool of unassigned telephone numbers and selects 
one telephone number from the pool at random. The ran- 
domly selected telephone number is provided to a valid 
65 subscriber of an authorized wireless telephone. The ran- 
domly selected telephone number is to be called by the valid 
subscriber using the authorized wireless telephone for the 
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purpose of collecting reference waveforms. A radio fre- 
quency (RF) receiver of the system monitors and receives 
call request transnaission signals from a plurality of wireless 
telephones. Each call request transmission signal contains a 
destination such as a telephone number and an identification 
of its wireless telephone such as M IN/ESN. The processor 
looks for the call request transmission signal whose desti- 
nation and the wireless telephone identification respectively 
correspond to the randomly selected telephone number and 
the identification of the authorized wireless telephone. This 
insures that that particular call request transmission signal 
belongs to the authorized wireless telephone of the valid 
subscriber rather than an unauthorized wireless telephone 
belonging to a pirate since the pirate has no way of knowing 
the randomly selected telephone number provided to the 
valid subscriber. The processor then extracts the reference 
waveform that represents a transmission characteristic of the 
authorized wireless telephone and stores the extracted ref- 
erence waveform in memory for use by the fingerprint 
analyzer. 

Id another aspect of the invention, the system collects 10 
to 40 reference waveforms to insure that there are suffi- 
ciently large number of samples from which to derive a 
fingerprint. In one embodiment, the vahd subscriber is asked 
to use the authorized wireless telephone to call the selected 
destination repeatedly for the purpose of the system collect- 
ing reference waveforms. Preferably, each time a reference 
waveform is collected, the processor connects the call to an 
announcement module that a^ the valid subscriber to call 
again if more reference waveforms are needed. Otherwise, 
the announcement module tells the vahd subscriber that the 
reference waveform collection process is complete and no 
more calls are necessary. 

In another embodiment, the system automatically collects 
all the reference waveforms required once it verifies that the 
call request transmission signal is transmitted by the autho- 
rized wireless telephone. This way, the valid subscriber 
needs to call the destination number only once regardless of 
the number of reference waveforms that are to be collected. 
In this embodiment, the system sends a polling message 
such as a page or registration request. The authorized 
wireless telephone receives the polling message and in 
response, transmits an RF signal containing the reference 
waveform. The system extracts the reference waveform 
from the RF signal and stores it in memory. The extracted 
reference waveform is then stored. The system repeatedly 
polls the authorized wireless telephone in order to receive a 
sufficiently large number of reference waveforms to be able 
to generate an accurate fingerprint during that one call. 

BRIEF DESCRIPTION OF THE DRAWINGS 
FIG. 1 is a flowchart for a method of collecting transmitter 
reference waveforms according to the present invention. 

FIG. 2 is a functional block diagram of a transmitter 
reference waveform collection system according to the 
present invention. 

FIG. 3 is a first alternative embodiment of the transmitter 
reference waveform collection system of the present inven- 
tion. 

FIG. 4 is a second altemative embodiment of the trans- 
mitter reference waveform collection system of the present 
invention. 

FIG. 5 is a flowchart of an alternative method of collect- 
ing transmitter reference waveforms according to the present 
invention. 

FIG. 6 is a functional block diagram of a transmitter 
reference waveform collection system implementing the 
method of FIG. 5. 
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DETAILED DESCRIPTION OF THE 
INVENTION 

For a more complete understanding of the present 
invention, the operation of a wireless cellular telephone 

^ system will be briefly discussed. Although the discussion 
that follows is directed to cellular telephones, it should be 
clearly understood that the invention can be used with any 
wireless telephone devices that may transmit voice such as 
cellular telephones or data such as data modems. Persons of 
ordinary skiU in the art will also appreciate that the tech- 
niques described herein may be used in any type of wireless 
communications systems including personal communica- 
tions services (PCS) systems. The term telephone as used 
herein is intended to include devices for wireless voice and 
data communication. 

FIG. 1 is a flowchart of a reference waveform collection 
routine 10 for collecting reference waveforms that arc used 
in building a fingerprint of a cellular telephone. The "cellular 

20 telephone" as used herein includes any mobfle telephone 
used in single site or multiple cell site telephone systems. In 
step 12, the routine 10 identifies and selects a cellular 
telephone whose fingerprint needs to be established In one 
embodiment, the routine 10 monitors active calls from a 

25 selected group of cell sites and generates a list of cellular 
telephones by their ESN and MIN. The cellular telephones 
in the list are currently transmitting during a call and are 
being used by users. From the list, one ceUular telephone is 
selected. Step 12 also verifies that the selected cellular 

3Q telephone is being used by an authorized user (subscriber). 
There are many methods of verification. One method is to 
obtain the dialed digits of the party to which the cellular 
telephone is connected and compare the digits against a 
database of frequently called numbers of the selected cel- 

35 lular telephone. If there is a match, the routine 10 assumes 
that the cellular telephone in use belongs to an authorized 
user rather than a pirate. Other methods of verification 
include comparing the dialed digits against a database of 
known telephone numbers previously called by cloned 
phones. If there is a match, then the routine 10 assumes a 
pirate is operating the cloned telephone and the verification 
fafls. Once the cellular telephone passes the verification 
process, the routine 10 waits until the telephone hangs up. 
Upon hang-up, the routine 10 is ready to start coUecting 

45 reference waveforms from the transmitter of the selected 
cellular telephone. At step 14, a polling message is sent to 
flie cellular telephone. Polling as used herein includes any 
transmission event capable of eliciting a suitable transmis- 
sion response from the selected cellular telephone. 

50 Preferably, a page, registration, audit or maintenance mes- 
sage is used as the polling message so that the process of 
polling occurs in the badcground for the sole purpose of 
collecting reference waveforms fix)m the selected cellular 
telephone. In this way, the process is totaUy transparent to 

55 the user and multiple reference waveforms may be collected 
from time to time without ever bothering the user of the 
cellular telephone. 

In response to the poll, the selected cellular telephone 
turns on its transmitter and transmits an RF signal containing 

60 a response message and a reference waveform. In one 
embodiment, the reference waveform may be the turn-on 
transient, represented by the leading portion of the RF 
signal, the mm-oflf transient, represented by the trailing 
portion of the RF signal, of the cellular telephone's trans- 

65 mitter or some other portion of the RF signal. Such reference 
waveforms are described in greater detail in the Ferrell 
patent. At decision 16, the routine 10 checks for a response 
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from the selected cellular telephone. If there is no response 
within a predetermined time period, control passes to step 
28. If there is a response, however, the reference waveform 
contained in the RF signal is obtained and stored, and 
control passes to decision 18. While the stored reference 
waveform may be an actual RF waveform, it is preferably a 
baseband demodulated waveform. 

At decision 18, a check is made to ensure that the received 
reference waveform is valid. For example, in decision 18 a 
check is made for the receipt of multiple reference wave- 
forms and whether the reference waveform was received 
from a cell site other than the group of selected cell sites. 
Either condition may signify that a cloned cellular telephone 
may be operating at the same time as the selected cellular 
telephone. In decision 18, a check is also made of the quality 
of the received reference waveform. As can be appreciated, 
the quahty of the reference waveform is affected by many 
factors such as the location of the cellular telephone, 
strength of the battery in the cellular telephone, multipatb 
interference, or other sources of radio fiequency interfer- 
ence. Hius, if the received reference waveform grossly 
deviates from an expected reference waveform, step 19 is 
executed and the received reference waveform is discarded. 
Subsequently, control passes to step 14 where the cellular 
telephone is polled again. However, if the received reference 
waveform is determined to be valid, step 20 is executed. 

In the routine 10. steps 14-20 are repeated until a suffi- 
cient number of valid reference waveforms arc collected. As 
the reference waveforms are collected, step 20 builds a 
fingerprint of the selected cellular telephone. In one 
embodiment, certain transmission characteristics including 
turn-on transmitting amplitude, phase modulation versus 
time, and deviation from a center frequency may be derived 
from the received reference waveforms. The process of 
obtaining such a fingerprint is described in more detail in the 
Ferrell patent. Alternatively, a fingerprint may comprise a 
composite mean waveform derived from the received ref- 
erence waveforms, and standard deviation and variance of 
the received reference waveforms. The process of obtaining 
such a fingerprint is described in more detail in a related 
application, entitled "ADAPTIVE WAVEFORM MATCH- 
ING FOR USE IN TRANSMirrER IDENTinCAnON," 
Ser. No. 08/611,429, filed on Mar. 6, 1996, and having a 
common assignee, which is incorporated herein by refer- 
ence. In step 20, normalization and alignment of the wave- 
forms with respect to each other may also be performed as 
part of building the fingerprint. 

In decision 22, it is determined whether a sufficient 
number of valid reference waveforms have been collected. 
In one embodiment, at least 10 reference waveforms and 
preferably 20-40 reference waveforms are considered suf- 
ficient- Alternatively, the number of received reference 
waveforms may be considered sufficient when the variance 
of the received reference waveforms is below a predeter- 
mined threshold level. 

If in decision 16 there is determined to be no response 
from the selected cellular telephone, in decision 28 it is 
determined whether at least one valid reference waveform 
has been received. While it is preferable to collect at least 10 
waveforms, the present invention may work with only one 
reference waveform. If no reference waveform has been 
received at all, control passes to step 30 where the routine 10 
ends. If there has been at least one response, however, 
control passes to step 24. 

In step 24, the fingerprint built from step 20 is optimized. 
This step may be performed in real-time or at a later time 
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when fingerprints for a group of cellular telephones may be 
processed. In step 24, a more rigorous analysis and process- 
ing of the received reference waveforms are performed in 
order to obtain an optimized fingerprint. The optimization 

5 step may include rejection of some of the received reference 
waveforms based on statistical analysis, and improved nor- 
malization and alignment of the waveforms. 

In step 26, the optimized fingerprint is stored in a data- 
base. Preferably, digital data representing the received ref- 
erence waveforms are also stored in the database for future 
use including further optimization of the fingerprint and 
obtaining a different type of fingerprint. As will be appre- 
ciated by persons of ordinary skill in the art, the waveform 
collection routine 10 may also be used to update the finger- 
print database in order to obtain a new or revised fingerprint 
to accommodate changes that may occur over time in the 
transmitter of the cellular telephone. Once the optimized 
fingerprint is stored, the routine 10 ends at step 30. 

Persons of ordinary skill in the art will appreciate that the 
reference waveform collection routine 10 described above 

20 provides the advantage of rapidly collecting reference wave- 
forms from a large number of transmitters by actively 
polling the cellular telephones without waiting for the cel- 
lular telephones to turn on as was previously necessary. 
Moreover, the reference waveform collection routine occurs 

25 in the background and the users of the cellular telephones are 
totally unaware of the collection process. Preferably, the 
waveform collection system uses an already existing cellular 
telephone system to provide a convenient and cost-effective 
method of collecting reference waveforms. 

30 A functional block diagram of a reference waveform 
collection system according to one embodiment of the 
present invention is shown in FIG. 2. A cell controller 40 of 
a cell site 38 is connected to a cellular switching system 42 
through voice and control lines 44. The cellular switching 

35 system 42, also referred to as a mobile telecommunications 
switching office (MTSO), is located at the cell site 38 but is 
typically connected to multiple other cell sites. The cellular 
switching system 42 is in turn connected to a public switch 
network (not shown). A modulator 46 connected to the cell 

40 controller 40 receives control messages and modulates them 
onto a carrier frequency in the 800 MegaHertz (MHz) range 
which represents the frequency of a forward control channel. 
It is to be understood, however, that the present invention is 
not limited by the particular carrier frequency which may be 

45 different depending on the wireless telephone system being 
used, A control channel (CCH) editor 62, which will be 
described in greater detail below, is connected to the modu- 
lator 46 through a control channel (CCH) transmitter 48. The 
CCH editor 62 transmits the modulated RF signal on the 

50 forward control channel using a transmitting antenna 50. A 
selected cellular telephone 52 receives the transmitted RF 
signal through an antetma 54 and in response to the received 
control message, transmits on a reverse control channel an 
RF signal containing a response message and a reference 

55 waveform. A control channel (CCH) receiver 56 receives the 
RF signal from the cellular telephone 52 through a receiving 
antenna 58. A demodulator 60 connected to the CCH 
receiver 56 demodulates the RF signal into a baseband 
waveform. The cell controller 40 is connected to the 

60 demodulator 60 and receives the baseband waveform. The 
cell controller 40 retrieves the re^onse message from the 
baseband waveform and performs an appropriate action 
according to the response message contained in the RF 
signal transmitted by the cellular telephone 52. The ceU site 

65 38 typically includes other modules such as voice channel 
(VCH) transmitters and receivers, which are omitted from 
FIG. 2 for clarity. 
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An active reference waveform collection system 64 is 
connected to the CCH editor 62. The waveform coUectioo 
system 64 includes a processor 66 connected to a memory 
68. The waveform collection routine 10 of FIG. 1 is stored 
in the memory 68 and is executed by the processor 66. As 
will be appreciated by persons of ordinary skill in the art, the 
reference waveform collection routine 10 of HG. 1 may be 
executed by an already existing processor (not shown) in the 
cell controller 40 or in the cellular switching system 42 
depending on whether the processor has sufficient process- 
ing power to handle both the call processing and waveform 
collection. Similarly, the waveform collection routine 10 of 
FIG. 1 may be stored in the memory (not shown) of the cell 
controller 40 or the cellular switching system 42. According 
to the invention, the processor 66 formats a polling message 
and sends it to the CCH editor 62 over a control and data bus 
70. The CCH editor 62 inserts the polling message received 
on the control and data bus 70 into the RF signal received 
from the CCH transmitter 48, The CCH editor 62 is 
described in more detail in the Rudokas patent. The modified 
RF signal containing the polling message is then transmitted 
through the transmitting antenna 50. The selected cellular 
telephone 52 receives the polling message and transmits an 
RF signal containing a response message and a reference 
waveform. 

The RF signal from the cellular telephone 52 is received 
by not only the CCH receiver 56 but also by a control 
channel (CCH) receiver 72 of the waveform ooUection 
system 64 through the receiving antenna 58. While the CCH 
receiver 72 of the waveform collection system 64 is separate 
from the CCH receiver 56 for timing and performance 
reasons, the existing CCH receiver 56 in the cell site 38 may 
be used instead. A demodulator 74 demodulates the RF 
signal received by the CCH receiver 72 into a baseband 
waveform. An analog to digital (A/D) converter 76 converts 
the baseband waveform into a digital waveform. The pro- 
cessor 66 extracts the reference waveform contained in the 
digital waveform, which is used to build a fingerprint of the 
transmitter of the cellular telephone 52. As discussed above, 
the reference waveform may be the tum-on transient, rep- 
resented by the leading portion of the digital waveform, or 
the turn-ofi[ transient, represented by the trailing portion of 
the digital waveform, of the cellular telephone's transmitter. 
The processor then stores the reference waveform into the 
memory 68. While it is preferable to obtain the reference 
waveform from the demodulated baseband waveform, it 
may be obtained from the unmodulated RF waveform. This 
is done by connecting the A/D converter 76 to the CCH 
receiver 72 in order to convert the original RF waveform 
into a digital waveform provided that the sampling rate of 
the A/D converter 76 can be increased to the GigaHertz 
(GHz) range. 

From FIG. 2, persons of ordinary skill in the art will 
appreciate that the present invention, including the reference 
waveform collection system 64 and CCH editor 62, is 
designed to be used with an existing cell site to provide a 
cost effective method of collecting reference waveforms. 

Afunctional blodc diagram of a first altcmativc waveform 
collection system according to the present invention is 
shown in FIG. 3, FIG. 3 illustrates a less intrusive way of 60 
adding the waveform collection system 64 into the cell site 
38. Rather than using the CCH editor 62 of FIG. 2, in this 
embodiment the existing cellular switching system 42 is 
used to poll the selected cellular telephone 52, Specifically, 
the system 64 initiates a telephone call to the selected 
cellular telephone 52 to elicit a transmission response con- 
taining a reference waveform. Once the system 64 obtains 
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the reference waveform, the system releases the call in 
progress before the selected telephone 52 rings so that the 
user of the selected cellular telephone 52 is unaware of the 
collection process. 

The waveform collection system 64 includes a line inter- 
face circuit 78 that is connected to the control and data bus 
70. A trunk line 80 connects the line interface circuit 78 to 
the cellular switching system 42. According to the invention, 
the processor 66 polls the selected cellular telephone 52 by 
dialing its telephone number through the interface circuit 78. 
The interface circuit 78 sends the dialed digits to the cellular 
switching system 42 through the trunk line 80. The trunk line 
80 may be a plain old telephone service (POTS) line, 
integrated services digital network (ISDN) line, Tl line, 
subscriber loop carrier (SLQ line, or any other line that may 
be interfaced to the cellular switching system 42. 
Alternatively, a plain telephone or cellular telephone may be 
connected to the line interface circuit 78 rather than the trunk 
line 80 in order to dial the telephone number of the selected 
cellular telephone 52. The cellular switching system 42 
sends the received dialed digits to the cell controller 40 over 
the voice and control lines 44. In response, the cell controller 
40 sends a polling message, a page message in this case, to 
the selected cellular telephone 52 over the forward control 
channel. The cellular telephone 52 receives the polling 
message and transmits an RF signal containing a response 
message responsive to the polling message over the reverse 
control channel. The RF signal from the cellular telephone 
52 is received by the CCH receiver 72 of the waveform 
collection system 64 through the receiving antenna 58. The 
demodulator 74 demodulates the RF signal received by the 
CCH receiver 72 into a baseband waveform. The A/D 
converter 76 converts the baseband waveform into a digital 
waveform. From the digital waveform, the processor 66 
extracts a reference waveform to be used in building a 
fingerprint of the cellular telephone*s transmitter. As dis- 
cussed above, the reference waveform may be the mrn-on 
transient, represented by the leading portion of the digital 
waveform, or the tiu'n-off transient, represented by the 
trailing portion of the digital waveform, of the cellular 
telephone's transmitter. 

When the processor 66 obtains the reference waveform 
from the received RF signal, it orders the interface circuit 78 
to disconnect the call in progress initiated by the line 
interface circuit. In response, the interface circuit 78 releases 
the trunk line 80. The cellular switching system 42 then 
informs the cell controller 40 that the call has been released. 
Preferably, the call is released before the cell controller 40 
has had a chance to assign a voice channel for the selected 
cellular telephone 52. Releasing the call before the voice 
channel assignment prevents ringing of the selected cellular 
telephone 52 so that the user does not know that the 
telephone was polled in order to collect a reference wave- 
form. As such, multiple reference waveforms may be col- 
lected from time to time without ever bothering the user of 
the selected cellular telephone being polled. 

A functional block diagram of a second alternative refer- 
ence waveform collection system according to the present 
invention is shown in FIG. 4. FIG. 4 illustrates another way 
of adding the waveform collection system 64 to the ceU site 
38. Rather than using the CCH editor 62 of FIG. 2, in this 
embodiment the existing cell controller 40 is used to poll the 
cellular telephone 52. An I/O interface circuit 82 is included 
in the waveform collection system 64 and connected to the 
control and data bus 70. An I/O line 84, such as a tty line, 
connects the I/O interface circuit 82 to a control terminal 
port (not shown) of the cell controller 40. The manner in 
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which the cellular telephone 52 is polled through the I/O line whose fingerprint needs to be established. The valid sub- 

84 depends on the particular make of the cell controller 40. scriber is then told to call the destination telephone number 

In some cell controllers, the processor 66 polls the cellular for the purpose of collecting reference waveforms of the 

telephone 52 by directly inputting I/O polling commands to authorized cellular telephone 52. In step 106, the routine 100 

the control terminal port of the cell controller 40. In other 5 clears the stored fingerprint if it already exists since the 

controllers, the cellular telephone 52 may be polled by previously stored fingerprint may no longer reflect the 

nmning a utility program stored in the cell controller 40. transmission characteristics of the authorized cellular telc- 

Alteraatively, the I/O line 84 may be connected to a control phone 52. 

terminal port (not shown) of the cellular switching system In step 108, the routine 100 monitors radio frequency 

42 to poll the selected cellular telephone 52. Again, the transmission signals from a plurality of cellular telephones 

manner in which the cellular telephone 52 is polled through in the process of establishing a call. As is well known in the 

the cellular switching system 42 depends on the particular art, each of these transmission signals contains an origina- 

make of the switching system. tion message comprised of the MIN/ESN uniquely identi- 

According to the present invention, a system and method fying the authorized cellular telephone 52 and a destination 

for coUecting reference waveforms from a transmitter of a telephone number (called address). For each transnussioa 

mobile phone has been described. The present invention signal, in decision 110 it is determined whether the MIN/ 

provides the advantage of rapidly collecting reference wave- ESN and the destination telephone number contained in the 

forms from a large number of transmitters by actively transmission signal match the authorized telephone's MIN/ 

polling the transmitters without waiting for the transmitters ESN and the associated randomly selected destination tele- 

to turn on as was previously necessary. Moreover, the phone number that was provided to the valid subscriber in 

reference waveform collection process occurs in the bade- 20 step 104. If the decision is NO, control passes to step 108 

ground and the users of the cellular phones are totally where the routine 100 continues to continuously monitor the 

unaware of the process. In a preferred embodiment, the transmission signals. If, however, the decision 110 is YES, 

reference waveform collection system is designed to be used it signifies that the transmission signal containing the ran- 

with an existing cell site to provide a cost effective method domly selected destination number was transmitted by the 

of collecting reference waveforms. 25 authorized telephone of the valid subscriber since the pirate 

As discussed above, there are times when the stored has no way of knowing the randomly selected destination 
fingerprint of the authorized cellular telephone 52 may not number provided to the valid subscriber. In step 112, the 
reflect the true transmission characteristics of that cellular routine 100 extracts from the transmission signal a reference 
telephone. One possible reason may be a sophisticated pirate waveform that is indicative of a transmission characteristic 
has discovered how the fingerprint authentication system 3Q of the authorized cellular telephone 52 from which a fin- 
collects the reference waveforms and corrupted the stored gerprint can be derived. As discussed above, the reference 
fingerprint with a fingerprint of his own unauthorized eel- waveform may be the tura-on transient, represented by the 
lular telephone. To establish or reestablish a fingerprint of leading portion of the RF signal, the turn-off transient, 
the authorized telephone 52, an alternative reference wave- represented by the trailing portion of the RF signal, or any 
form collection routine 100 shown in FIG. 5 is used to 35 other portion of the transmission signal that represents a 
ensure that the reference waveforms being collected are transmission characteristic of the authorized cellidar tele- 
transmitted from the authorized cellular telephone rather phone 52. Such reference waveforms are described in 
than from the pirate's unauthorized cellular telephone. greater detail in the Ferrell patent. 

A cellular service provider maintains a pool of telephone Id decision 114, the routine 100 checks the quality of the 

numbers which have not been assigned to any user and 40 extracted reference waveform. As can be appreciated, the 

which have been specially selected for the purpose of quality of the extracted reference waveform is affected by 

collecting reference waveforms. In step 102, the routine 100 many factors such as the location of the authorized cellular 

randomly selects one unassigned number from the pool of telephone 52, strength of the battery in the telephone, 

unassigned numbers as a destination telephone number and multi-path interference, or other sources of radio frequency 

temporarily associates the selected number with the autho- 45 interference. If the reference waveform deviates from an 

rized cellular telephone 52. expected reference waveform, step 116 is executed in which 

Alternatively, the destination telephone number can be the extracted reference waveform is discarded, 

generated by a pseudo-random number-generating algo- Subsequently, control passes to step 108 where the routine 

rithm. For example, identification data, such as the ESN or 100 continues to continuously monitor the transmission 

MIN of the authorized telephone 52, may be used as a seed 50 signals. However, if the reference waveform is determined 

for any of a number of well-known pseudo-random number- to be valid, step 118 is executed and the reference waveform 

generating algorithms. The pseudo-random number may be is stored in memory. 

truncated to a predetermined number of digits to correspond As the reference waveforms are collected, or 
to a destination telephone number. In this embodiment, it is subsequently, step 120 builds a fingerprint of the authorized 
possible that the destination telephone number may corre- ss cellular telephone 52. In one embodiment, certain transmis- 
spond to an actual telephone number assigned to another sion characteristics including turn-on transmitting 
valid subscriber. However, the routine 100 can be designed amplitude, phase modulation versus time, and deviation 
to collect reference waveforms and terminate the call before from a center frequency may be derived from the received 
the cell site controller actually processes the telephone call. reference waveform. Tlie process of obtaining such a fin- 
In this manner, the other valid subscriber will not be 60 gerprint is described in more detail in the Ferrell patent. In 
dismrbed by unwanted calls. In addition, the routine 100 can decision 122, it is determined whether a sufficient number of 
check the pseudo-random destination telephone number to valid reference waveforms have been collected. In one 
assure that certain destination telephone niunbers, such as embodiment, at least 10 waveforms and preferably 20-40 
emergency telephone numbers, arc not supplied to the waveforms is considered suflBcient. If decision 122 is NO, 
subscriber. 6S control passes to step 108 and the routine 100 again con- 
In step 104, the selected destination number is provided to tinuously monitors the transmission signals. If decision 122 
a valid subscriber of the authorized cellular telephone 52 is YES, step 124 is executed. 
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Id step 124, the flogerprim built from step 120 is opti- from the cellular telephone 52 through the receiving antenna 

mized. This step may be performed in real-time or at a later 58. The demodulator 60 connected to the CCH receiver 56 

time when fingerprints for a group of cellular telephones demodulates the RF signal into a baseband waveform. The 

may be processed. In step 124, a more rigorous analysis and cell controller 40 receives the baseband waveform and 
processing of the stored reference waveforms are performed 5 retrieves a caU request message contained in the baseband 

in order to obtain an optimized fingerprint The optimization waveform and establishes a voice connection to the cellular 

step may include rejection of some of the received reference ^^^P^'"'J\ '.'^""S'' > ^i"" 0^^") ^^^Tu' 

waveforms based on statistical analysis, and improved nor- «* '^''^ ""^ '» ceU controUer 40 and he 

malization and alignment of the waveforms. In step 126. the ""f-^"? ^0. The ceUuJar switchmg system 42 oonnecu the 
optimized fingerprint is stored in a daUbase. Preferably, lO call to its destination through the pubhc switch network (not 

digital data representing the received reference waveforms * own;. 

are also stored in the database for future use including ^^^^^ PIG the reference waveform coUection system 

further optimization of the fingerprint and obtaining a dif- ^ °f « processor 66 connected to the 

ferent type of fingerprint. Once the optimized fingerprint is ">emory 68 through the control and data bus 70. The 
stored, the routine 100 ends at step 130. 15 reference waveform collection routme 100 of FIG. 5^ 

- , Ml . .t_ Stored m the memory (58 and IS executed by the processor 66. 

As can be appreciated by persons of ordmary skiU m the ^ appreciated by persons of ordinary skill in the art, 

art, the routine 100 provides maxmium protection against ^^^^^^^ coUection routine 100 of FIG. 5 may be 

obtaunng erroneous reference waveforms &om a pirate s executed by an already existing processor (not shown) in the 

unauthorized cellular m ephone by verifying ead^ ^^^j ^^^J^^^ ^ ^/-^ ^^^^^^^ ^^^^ ^2 

by the valid subscnber's authorized ceUular telephone ^. 20 ^^^^^^^ ^^^^^ ^^^^^^^ 

TTiis also means, however that the routine 100 reqmres the ^^^^^ h^^dle both the call processing and 

valid subscriber to call the randomly selected destination coUeclioa. The waveform collection routine 100 

number at least 10 times m order to collect 10 reference p,^ ^ ^^^^^^^^ ^ ^^^^^ computer 

wavefooDS that are necessary m the preferred embodiment ^ which is connected to the processor 66 through an 

to build an accurate fingerprint. input/output (I/O) interface circuit 98 connected between the 

As currenUy envisioned, the reference waveform collec- ^^^^ ^^t^ 95 ^nd the control and data bus 70. 

tion routine 100 is designed to be used when the fingerprint Similarly, the waveform collection routine 100 of FIG. 5 

of the valid subscriber's cellular telephone is corrupted and ^ay be stored in the memory (not shown) of the cell 

as a resuU, the subscriber experiences blocked calls. As can controller 40, the cellular switching system 42 or the central 

be appreciated, the subscriber is probably upset about the computer system 92. Preferably, the processor 66 in the 

blocked calls and the cellular service provider may be system 64 and the central computer system 92 are load 

unwilling to further inconvenience the subscriber by requu- shared such that processing of certain tasks may take place 

ing him to call the randomly selected number at least 10 ^ ^^^^^ system depending on which system is busier at the 



times. 



35 



time. 



Accordingly, the present invention provides an ahernative Iq operation, the processor 66 extracts the reference 

embodiment that requires the vahd subscriber to call the waveform contained in the digital waveform, which is used 

randomly selected destination number only once regardless to build a fingerprint of the transmitter of the cellular 

of the number of reference waveforms that need to be telephone 52, As discussed above, the reference waveform 
collected. In this embodiment, tt^ more active reference ^ may be the tum-on transient, represented by the leading 

waveform collection routine 10 of FIG. 1 is used once the portion of the digital waveform, or the turn-off transient, 

initial call from the valid subscriber is verified through steps represented by the trailing portion of the digital waveform, 

102-110 of the routine 100 of FIG. 5 as being transmitted by of the cellular telephone's transmitter. The processor then 

the authorized cellular telephone 52. After the initial veri- stores the reference waveform into the memory 68 through 

fication of steps 102-110, and after the reference waveform the control and data bus 70. While it is preferable to obtain 

extracted from the initial call is either stored or discarded in the reference waveform from the demodulated baseband 

steps 112-118, the authorized cellular telephone 52 is waveform, it may be obtained from the unmodulated RF 

repeatedly polled in order to rapidly collect a sufficient waveform. This is done by connecting the A/D converter 76 

number of reference waveforms necessary to generate an to the CCH receiver 72 in order to convert the original RF 

accurate fingerprint using steps 14-22 and 28 of FIG. 1. waveform into a digital waveform provided that the sam- 

When a sufficient number of reference waveforms are pijng rate of the A/D converter 76 can be increased to the 

collected, the optimization and storage steps 124 and 126 are GigaHertz (GHz) range. 

performed. The system 64 of FIG. 6 includes a fingerprint analyzer 90 

FIG. 6 shows a functional block diagram of a reference connected to the control and data bus 70 which performs a 
waveform collection system implementing the reference 55 fingerprint analysis of a transmission characteristic of the 

waveform collection routine 100 of FIG. 5. The system of transmitter in the cellular telephone 52. The fingerprint 

FIG. 6 incorporates the basic system of FIG. 4 previously analyzer 90 may be a digital signal processor (DSP), a part 

described. In this embodiment, the reference waveform of the processor 66, a separate processor, or the like. As 

collection system 64 of each of a pluraUty of cell sites 38 is discussed above, any acceptable fingerprint analysis tech- 
connected to a central computer system 92 through a high- 59 nique wiU operate satisfactorily with the system 64. 

speed data link 96 to control a group of cell sites. An announcement module 94 is connected to the wave- 

The cellular telephone 52 may initiate a call by transmit- form collection system 64 and the central computer system 

ling on a reverse control channel a call request RF trans- 92 through the high speed data link 96. The announcement 

mission signal. The call request signal contains a destination module 94 is also connected to the cellular switching system 
such as a telephone number and an identification of its 65 42 through a fine 99. The line 99 may be a plain old 

cellular telephone such as the MIN/ESN. The control chan- telephone service (POTS) line, integrated services digital 

nel (CCH) receiver 56 receives the RF transmission signal network (ISDN) line. Tl line, subscriber loop carrier (SLC) 



01/22/2004, EAST Version: 1.4.1 



5,999,; 

13 

liae, or any other line that may be interfaced to the cellular 
switching system 42. 

As described above, the central computer system 92 
maintains a plurality of unassigned telephone numbers. 
These numbers are programmed in the cellular switching 5 
system 42 to be routed to the line 99. Thus, when the vahd 
subscriber calls the randomly assigned destination number 
using the authorized cellular telephone 52, the cellular 
switching system 42 receives the destination number 
through the voice and control lines 44 and routes the call to 
the line 99 through the VCH transceiver unit 86 and the cell 
controller 40. In a preferred embodiment, during execution 
of decision 122 of the routine 100 of FIG. 5, the central 
computer system 92 connects the announcement module 94 
to the line 99 to play a voice message requesting the valid 
subscriber to call again if more reference waveforms are 
needed. Otherwise, the announcement module plays a mes- 
sage telling the valid subscriber that the reference waveform 
collection process is complete and no more calls are neces- 
sary. The voice messages from the announcement module 94 
are transmitted to the authorized cellular telephone 52 
through the VCH transceiver unit 86. 

From the foregoing it will be appreciated that, although 
specific embodiments of the invention have been described 
herein for purposes of illustration, various modifications 
may be made without deviating fi-om the ^irit and scope of 
the invention. Accordingly, the present invention is not 
limited except as by the appended claims. 

What is claimed is: 

1. A method of collecting a reference waveform fi"om an 
authorized wireless telephone in a wireless telephone system 
including a fingerprint analyzer that identifies an un authen- 
ticated wireless telephone as authorized or fraudulent based 
on a fingerprint analysis by comparing a transmission char- 
acteristic of the unauthenticated wireless telephone with a 
stored fingerprint of a corresponding authorized wireless 
telephone, the method comprising the steps of: 

(a) selecting a first destination to be called by the autho- 
rized wireless telephone; 

(b) associating the selected destination to be called by the ^ 
authorized wireless telephone with a first identification 

of the authorized wireless telephone; 

(c) receiving from a wireless telephone a transmission 
signal containing a transmitted destination and a trans- 
mitted identification of the wireless telephone trans- 45 
milling the transmission signal; 

(d) determining whether the transmitted destination and 
the transmitted identification of the transmitting wire- 
less telephone respectively correspond to the selected 
first destination and the associated first identification of 50 
the authorized wireless telephone; and 

(e) if the transmitted destination and the transmitted 
identification of the transmitting wireless telephone are 
determined to respectively correspond to the selected 
first destination and the associated first identification of 55 
the authorized wireless telephone, performing the fol- 
lowing steps: 

extracting from the transmission signal a reference 
waveform indicative of a transmission characteristic 
of the transmitting wireless telephone; and 60 

storing the extracted reference waveform as a reference 
waveform of the authorized wireless telephone for 
subsequent use by the fingerprint analyzer. 

2. The method according to claim 1, further comprising 
repeating steps (c) to (e) until a predetermined number of 65 
extracted reference waveforms are stored as reference wave- 
forms of the authorized wireless telephone. 
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3. The method according to claim 1 wherein step (e) 
further comprises the step or connecting the authorized 
wireless telephone to an announcement module. 

4. The method according to claim 3, further comprising 
the step of causing the announcement module to play a voice 
message indicating that a user of the transmitting wireless 
telephone is to call the selected first destination again 
whereby an additional reference waveform is collected. 

5. ThQ method according to claim 1, prior to step (c), 
further comprising the step of removing a previously stored 
fingerprint of the authorized wireless telephone. 

6. The method according to claim 1, further comprising 
the step of building a fingerprint using the stored extracted 
reference waveform. 

7. The method according to claim 1 wherein in step (a) the 
first destination to be called by the authorized wireless 
telephone is randomly selected from a plurality of predeter- 
mined unassigned destinations. 

8. The method according to claim 1 wherein in step (a) the 
first destination to be called by the authorized wireless 
telephone is a pseudo-random destination telephone number. 

9. The method according to claim 1 wherein step (e) 
further comprises repeating the following steps n times 
where n is greater than one: 

polling the transmitting wireless telephone to automati- 
cally stimulate a transmission response signal contain- 
ing a reference waveform indicative of a transmission 
characteristic of the transmitting wireless telephone; 

receiving firom the transmitting wireless telephone the 
transmission response signal responsive to the poll; 

extracting the reference waveform from the received 
transmission response signal; and 

storing the extracted reference waveform from the 
received transmission response signal for subsequent 
use by the fingerprint analyzer. 

10. The method according to claim 9 wherein the step of 
polling comprises transmitting to the transmitting wireless 
telephone one of a page, registration, audit and maintenance 
message to stimulate the transmission response signal. 

11. The method according to claim 9 wherein the step of 
polling comprises transmitting a page message to the trans- 
mitting wireless telephone, and further including, after the 
step of polling, the step of transmitting a hang-up message 
to the transmitting wireless telephone to prevent the trans- 
mitting wireless telephone from ringing. 

12. A method of collecting a reference waveform from an 
authorized wireless telephone to be subsequently used by a 
fingerprint analyzer to distinguish telephone calls made by 
the authorized wireless telephone from telephone calls made 
by an unauthorized wireless telephone, the method compris- 
ing the steps of: 

(a) selecting a destination to be called by the authorized 
wireless telephone; 

(b) associating the selected destination to be called by the 
authorized wireless telephone with an identification of 
the authorized wireless telephone; 

(c) monitoring transmission signals from a pluraUty of 
wireless telephones, each transmission signal contain- 
ing a destination and an identification of the wireless 
telephone transmitting the transmission signal; 

(d) identifying a transmission signal among the monitored 
transmission signals whose destination and identifica- 
tion contained therein respectively correspond to the 
selected destination and the associated identification of 
the authorized wireless telephone; 

(e) obtaining a reference waveform from the wireless 
telephone transmitting the identified transmission sig- 
nal; and 
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(f) storing the obtained reference waveform as a reference 19. The method according to claim 17 wherein step (f) 

waveform of the authorized wireless telephone for comprises extracting from the identified transmission signal 

subsequent use by the fingerprint analyzer. a reference waveform indicative of a transmission charac- 

13. The method according to claim 12 wherein step (e) teristic of the wireless telephone transmitting the identified 

comprises extracting from the identified transmission signal 5 transmission signal. 

a reference waveform indicative of a transmission charac- 20. The method according to claim 17, further compnsmg 
teristic of the wireless telephone transmitting the identified repeatmg steps (f) to until a predetermined number of 
^- „„t obtained reference waveforms are stored as reference wave- 
transmission signal. - - . • J • 1 » 1 u 

■tA -ru^ T> A,^K«,^r«««o;«,, forms of the authorized wireless telephone. 

14 TTiemeth(xi accordmg toclaim l2,fo^^^^ 21. The method according to claim 17, after step (e), 
repeatmg steps (e) to (Q until a predetermined number of lo ^^^^^^ comprising the step of connecting the wireless tele- 
reference waveforms are stored as reference waveforms of ^^^^ transmittir| the identified transmission signal to an 
the authorized wireless telephone. . amiouncement module. 

15. The method according to claun 12 wherem m step (a) 22. The method according to claim 21, farther comprising 
the destination to be caUed by the authorized wireless the step of causing the announcement module to play a voice 
telephone is randomly selected from a plurality of unas- 15 message indicating that the valid user of the authorized 
signed destinations, wireless telephone is to call the selected destination again 

16. The method according to claim 12 wherein in step (a) whereby an additional reference waveform is obtained, 
the destination to be called by the authorized wireless 23. The method according to claim 18, prior to step (d), 
telephone is a pseudo-random destination telephone number. ftirther comprising the step of removing a previously stored 

17. The method according to claim 12 wherein steps (e) 20 fingerprint of the authorized wireless telephone. 

to {f) comprise repeating the following steps n times where 24. The method according to claim 18, further comprising 

n is greater than one: the step of building a fingerprint using the stored reference 

polling the wireless telephone transmitting the identified ^^Jf ^2^°^* . ,-,oi- •• . r \ 
^ • • 1* * *• 11 »• 1 4 * 25. The method accordine to claim 18 wherein m step (a) 
transm^ionsigaal to automatically stunulate a tram- destination to be caufd by the authorized wi^l^ 
mission response signal containing a reference wave- « ^ selected from a plurality of unas- 
form indicative of a transnussion charactenstic of the siened destinations *- j 
wirel^ telephone transmitting the identified transmis- ^6. The method according to claim 18 wherein in step (a) 
sion signal; destination to be called by the authorized wireless 
receiving from the wireless telephone transmitting the telephone is a pseudo-random destination telephone number, 
identified transmission signal the transmission response 27. The method according to claim 18 wherein step (f) 
signal responsive to the poll; comprises: 
extracting the reference waveform from the received polling the wireless telephone transmitting the identified 
transmission response signal; and transmission signal to automatically stimulate a trans- 
storing the extracted reference waveform as a reference 35 mission response signal containing a reference wave- 
waveform of the authorized wireless telephone for form indicative of a transmission characteristic of the 
subsequent use by the fingerprint analyzer. wireless telephone transmitting the identified transmis- 

18. A method of collecting a reference waveform from an sion signal; 

authorized wireless telephone to be subsequently used by a receiving from the wireless telephone transmitting the 

fingerprint analyzer to distinguish telephone calls made by 49 identified transmission signal the transmission response 

the authorized wireless telephone from telephone calls made signal responsive to the poll; and 

by an unauthorized wireless telephone, the method compris- extracting the reference waveform from the received 

ing the steps of: transmission response signal. 

(a) selecting a destination to be called by a valid user 28. The method according to claim 27 wherein the step of 
using the authorized wireless telephone; 45 polling comprises transmitting to the wireless telephone 

(b) associating the selected destination with an identifi- transmitting the identified transmission signal one of a page, 
cation of the authorized wireless telephone; registration, audit and maintenance message. 

... , . t J . .i. i-j r 29. The method according to claim 27 wherem the step of 

(c) providmg the selected destination to the vahd user of comprises transmitting a page message to the wire- 
the authorized wireless telephone; telephone transmitting the identified transmission 

(d) momtonng transmission signals from a plurahty of ^^^^^^^ f^^her including, after the step of polUng, the 
wireless telephones, each transmission signal contain- ^^^^ transmitting a hang-up message to the wireless 
ing a destination and an identification of a wireless telephone transmitting the identified transmission signal to 
telephone; prevent the wireless telephone transmitting the identified 

(e) identifying among the monitored transmission signals 55 transmission signal from ringing. 

a transmission signal whose destination and identifica- 30. A system for collecting a reference waveform from an 

tion contained therein respectively correspond to the authorized wireless telephone to be subsequently used by a 

selected destination and the associated identification of fingerprint analyzer to distinguish telephone calls made by 

the authorized wireless telephone; the authorized wireless telephone from telephone calls made 

(f) obtaining, from the wireless telephone transmitting the so by an unauthorized wireless telephone, wherein a user of the 
identified transmission signal, a reference waveform authorized wireless telephone is provided with a destination 
indicative of a transmission characteristic of the wire- to be called using the authorized wireless telephone, the 
less telephone transmitting the identified transmission system comprising: 

signal; and a radio frequency (RF) receiver operable to receive trans- 

(g) storing the obtained reference waveform as a reference 65 mission signals from a pluraUty of wireless telephones, 
waveform of the authorized wireless telephone for each transmission signal containing a destination and 
subsequent use by the fingerprint analyzer. an identification of a wireless telephone; 
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a processor connected to the RF receiver, the processor 
operable to monitor transmission signals received by 
the RF receiver and select a transmission signal among 
the monitored transmission signals whose destination 
and identification contained therein respectively corre- 
spond to the provided destination and the identification 
of the authorized wireless telephone, and obtain a 
reference waveform from the wireless telephone trans- 
mitting the selected transmission signal, the obtained 
reference waveform being indicative of a transmission 
characteristic of the wireless telephone transmitting the 
selected transmission signal; and 

a memory connected to the processor and operable to 
store the obtained reference waveform as a reference 
waveform of the authorized wireless telephone for 
subsequent use by the fingerprint analyzer. 

31. The system according to claim 30 wherein the pro- 
cessor randomly selects the provided destination among a 
plurality of unassigned destinations. 

32. The system according to claim 30 wherein the pro- 
cessor pseudo -randomly generates the destination. 

33. The system according to claim 32 wherein the pro- 
cessor uses the identification of the authorized wireless 
telephone to generate the pseudo-random destination. 

34. The system according to claim 30, further comprising 
an aimouncement module connected to the processor and 
operable to play a voice message. 

35. The system according to claim 34 wherein the voice 
message indicates that the user of the wireless telephone 
transmitting the selected transmission signal is to call the 
provided destination again whereby an additional reference 
waveform is collected. 

36. The system according to claim 34, further comprising 
a switching system connected to the announcement module 
and programmed to route the call from the wireless tele- 
phone transmitting the selected transmission signal to the 
announcement module. 

37. The system according to claim 36, further comprising: 
a voice channel transceiver operable to transmit the voice 

message to the wireless telephone transmitting the 
selected transmission signal; and 
a cell controller connected to the voice channel trans- 
ceiver and the switching system, and operable to con- 
nect the voice channel transceiver to the switching 
system. 

38. The system according to claim 37 wherein the autho- 
rized wireless telephone is a cellular telephone and the RF 
receiver is a control channel receiver. 

39. A system for collecting a reference waveform from an 
authorized wireless telephone to be subsequently used to 
distinguish telephone calls made by the authorized wireless 
telephone from telephone calls made by an unauthorized 
wireless telephone, wherein a user of the authorized wireless 
telephone is provided with a destination to be called using 
the authorized wireless telephone, the system comprising: 

a radio firequency (RF) receiver operable to receive trans- 
mission signals from a plurality of wireless telephones, 
each transmission signal containing a destination and 
an identification of a wireless telephone; 
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a processor connected to the RF receiver, the processor 
operable to select a wireless telephone transmitting a 
transmission signal whose destination and identifica- 
tion contained therein respectively correspond to the 
provided destination and the identification of the autho- 
rized wireless telephone, and obtain a reference wave- 
form from the selected wireless telephone, the obtained 
reference waveform being indicative of a transmission 
characteristic of the selected wireless telephone; and 

a memory connected to the processor and operable to 
store the obtained reference waveform. 

40. The system according to claim 39 wherein the pro- 
cessor randomly selects the provided destination among a 
plurality of unassigned destinations. 

41. The system according to claim 39 wherein the pro- 
cessor pseudo-randomly generates the destination. 

42. The system acconding to claim 39, further comprising 
an announcement module connected to the processor and 
operable to play a voice message. 

43. The system according to claim 42 wherein the voice 
message indicates that the user of the selected wireless 
telephone is to call the destination again whereby an addi- 
tional reference waveform is collected. 

44. The system according to claim 42, further comprising 
a switching system connected to the announcement module 
and programmed to route the call from the selected wireless 
telephone to the announcement module. 

45. The system according to claim 44, further comprising: 
a voice channel transceiver operable to transmit the voice 

message to the selected wireless telephone; and 
a cell controller coimected to the voice channel trans- 
ceiver and the switching system, and operable to con- 
nect the voice channel transceiver to the switching 
system. 

46. The system according to claim 39, further comprising 
a fingerprint analyzer connected to the RF receiver and 
operable to identify an unauthenticated wireless telephone as 
authorized or fraudulent based on a fingerprint analysis by 
comparing a transmission characteristic of the unauthenti- 
cated wireless telephone with a stored fingerprint of a 
corresponding authorized wireless telephone. 

47. The system according to claim 39 located at a cell site 
for use with other similar collection systems located at other 
cell sites wherein the processor comprises: 

a first processor connected to the RF receiver and located 

at the cell site; 
a data link; and 

a second processor connected to the first processor 
through the data link, the second processor being 
connected to other processors of the other similar 
collection systems located at the other cell sites through 
the data hnk. 

48. The system according to claim 47 wherein the second 
processor is load shared with the first processor located at 
the cell site and the other processors located at the other cell 
sites. 
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